How do you implement brute force protection on the login endpoint in NestJS?

Q: How do you implement brute force protection on the login endpoint in NestJS?

// Option 1 — simple throttler @Module({ imports: [ ThrottlerModule.forRoot([{ name: 'login', ttl: 300_000, limit: 5 }]), ], }) export class AppModule {} @Throttle({ login: { ttl: 300_000, limit: 5 } }) @Post('auth/login') @UseGuards(AuthGuard('local')) login(@Request() req) { return this.authService.login(req.user); } // Option 2 — rate-limiter-flexible (robust, per-IP+email) @Injectable() export class BruteForceGuard implements CanActivate { private limiter = new RateLimiterRedis({ storeClient: redisClient, keyPrefix: 'login_fail', points: 5, // 5 attempts duration: 300, // per 5 minutes blockDuration: 900, // block for 15 minutes after limit }); async canActivate(ctx: ExecutionContext): Promise { const req = ctx.switchToHttp().getRequest(); const key = `${req.ip}_${req.body?.email ?? 'unknown'}`; try { await this.limiter.consume(key); return true; } catch (rlRes) { const retrySecs = Math.ceil(rlRes.msBeforeNext / 1000); throw new HttpException( `Too many login attempts. Retry after ${retrySecs}s`, HttpStatus.TOO_MANY_REQUESTS, ); } } } // Apply BruteForceGuard BEFORE the Passport guard @UseGuards(BruteForceGuard, AuthGuard('local')) @Post('auth/login') login(@Request() req) { return this.authService.login(req.user); } Key on both IP and email — prevents an attacker from rotating IPs to bypass IP-only limits. Apply the rate limit guard before the Passport guard — rejected requests never reach bcrypt.compare(). Block for longer than the window — 5 attempts in 5 minutes should block for 15+ minutes. Return Retry-After header so clients know when to try again — include it in the exception response. Use Redis-backed rate limiting in production — in-memory limiters are not shared across instances.

Difficulty: 5/10

rate limiting, guards, distributed cache

Use @nestjs/throttler for simple per-IP rate limiting. For robust protection use rate-limiter-flexible with Redis — it tracks failures per IP and email combination, applies progressive blocking after the limit is exceeded, and is shared across all instances. Apply the guard before the Passport guard so blocked requests are rejected without hitting the database.

Throttler and rate-limiter-flexible brute force protection

Brute force protection design rules:

How do you implement brute force protection on the login endpoint in NestJS?

Difficulty: 5/10

rate limiting, guards, distributed cache

Use @nestjs/throttler for simple per-IP rate limiting. For robust protection use rate-limiter-flexible with Redis — it tracks failures per IP and email combination, applies progressive blocking after the limit is exceeded, and is shared across all instances. Apply the guard before the Passport guard so blocked requests are rejected without hitting the database.

Throttler and rate-limiter-flexible brute force protection

Brute force protection design rules:

How do you implement brute force protection on the login endpoint in NestJS?

How do you implement brute force protection on the login endpoint in NestJS?

Scenario Questions

Follow-up Questions